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DETAILED ACTION 

Claim Rejections - 35 USC §103 

1 . The following is a quotation of 35 U.S.C 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

2. Claims 1 and 3 are rejected under 35 U.S.C. 103(a) as being unpatentable over Yin 
(2002/0091539) in view of 65 Fed. Reg. 82796 (Dec. 28, 2000). 

As per claim 1, Yin teaches the method for creating and managing multilateral 
contractual relationships among contracting parties under a privacy standard, said contracting 
parties comprising (1) "covered entities" receiving data of customers and creating, recording, 
using, and disclosing private data of such customers in the ordinary course of business and (2) 
"business associates" requiring the use of said private data, said method comprising the steps of: 

(a) assigning digital identities to the contracting parties (via f's 126-127); 

(b) providing a multilateral Master Business Associate Contract (MB AC) template (via 
the contract template based on XML, ^ 136 lines 3-4); 

(c) providing an electronic interface accessible to said digital identities to facilitate 
negotiating and entering binding multilateral contractual agreements among at least one of said 
covered entities and a plurality of said business associates pursuant to the terms of said MB AC 
template (the addressed party adds or modifies clauses to the document and save[s] it. The 
saving process presents the document to the originating party highlighting the changes. The 
process repeats until the two parties agree on the terms, If 143 lines 407); and 
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(d) storing said multilateral contractual agreements in an MBAC database, (the final 
signed document will be saved, ^ 143 line 8) 

However, Yin fails to explicitly disclose that the template has non-negotiable terms 
requiring observation of said privacy standard with respect to said private data of customer. 

The Federal Registrar teaches that Federal rules require non-negotiable terms that require 
observation of privacy standards with respect to customer data. For example, Section 164.530 
requires an entity to maintain specific policies and procedures in written or electronic form to 
protect health information. 

It would have been obvious to one skilled in the art of contractual agreements to modify 
the method for creating contracts of Yin with the non-negotiable terms as taught by the Federal 
Registrar in order to protect the privacy of the medical data of customers. Motivation is evident 
based on the fact that these agreements are common and any automation would save a great deal 
of time. 

As per claim 3, Yin teaches the method wherein said electronic interface includes 
interactive means for negotiating additional terms with respect to the use or disclosure of said 
private data (the action of save a contract triggers the negotiation process sending the contract to 
the addressed party, ^[143 lines 1-3) 

3. Claims 2, 4, 5 and 7-11 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Yin (2002/0091539) and 65 Fed. Reg. 82796 (Dec. 28, 2000), as applied to claim 1 
above, and further in view of Smithies (5,818,955). 

As per claim 2, the Yin and Fed. Reg. combination fails to teach the additional step of 
providing self-certification provisions in said MBAC for contracting parties to certify adherence 
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to said privacy standard as self certified covered entities or as self-certified business associates. 
However, Smithies provides a document and signature verification system including a sample 
self-certification form (Fig. 3A). While the sample form does not explicitly state adherence to 
said privacy standard, it is clear that the self certification form can be modified to adhere to any 
contractual agreement. It would have been obvious to one skilled in the art of electronic 
contractual agreements to modify the self-certification form and use within the Yin and Fed. 
Reg. system. 

Motivation to combine the Smithies self-certification form with the Yin and Fed. Reg. 
combination is the fact that the self-certification allows agreements that would otherwise not be 
binding to become binding in a quick, inexpensive, and efficient way. 

As per claim 4, Yin teaches the method for creating and managing multilateral 
contractual relationships among contracting parties under a privacy standard, said contracting 
parties comprising (1) "covered entities" receiving data of customers and creating, recording, 
using, and disclosing private data of such customers in the ordinary course of business, and (2) 
"business associates" requiring use of said private data, said method comprising the steps of: 

(a) assigning digital identities to the contracting parties (via f's 126-127); 

(b) providing a multilateral Master Business Associate Contract (MBAC) template (via 
the contract template based on XML, f 136 lines 3-4); 

(d) providing an electronic interface accessible to said digital identities to facilitate 
negotiating and entering binding multilateral contractual agreements among a least one of said 
self certified covered entities and a plurality of said self- certified business associates pursuant to 
the terms of said MBAC template (the addressed party adds or modifies clauses to the document 
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and save[s] it. The saving process presents the document to the originating party highlighting the 
changes. The process repeats until the two parties agree on the terms, J 143 lines 407); and 

(e) storing said multilateral contractual agreements in an MBAC database, (the final 
signed document will be saved, H 143 line 8) 

However, Yin fails to explicitly disclose that the template has non-negotiable terms 
requiring observation of said privacy standard with respect to said private data of customer. 

The Federal Registrar teaches that Federal rules require non-negotiable terms that require 
observation of privacy standards with respect to customer data. For example, Section 164.530 
requires an entity to maintain specific policies and procedures in written or electronic form to 
protect health information. 

It would have been obvious to one skilled in the art of contractual agreements to modify 
the method for creating contracts of Yin with the non-negotiable terms as taught by the Federal 
Registrar in order to protect the privacy of the medical data of customers. Motivation is evident 
based on the fact that these agreements are common and any automation would save a great deal 
of time. Yin further fails to disclose (c) providing self-certification procedures for contracting 
parties to certify adherence to said privacy standard as self-certified covered entities or as self- 
certified business associates. 

Smithies provides a document and signature verification system including a sample self- 
certification form (Fig. 3A). While the sample form does not explicitly state adherence to said 
privacy standard, it is clear that the self certification form can be modified to adhere to any 
contractual agreement. It would have been obvious to one skilled in the art of electronic 
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contractual agreements to modify the self-certification form and use within the Yin and Fed. 
Reg. system. 

Motivation to combine the Smithies self-certification form with the Yin and Fed. Reg. 
combination is the fact that the self-certification allows agreements that would otherwise not be 
binding to become binding in a quick, inexpensive, and efficient way. 

As per claim 7, Yin teaches the method wherein said electronic interface includes 
interactive means for negotiating said additional terms with respect to use or disclosure of said 
private data. (In the simplest scenario the addressed party adds or modifies clauses to the 
document and save[s] it. The saving process presents the document to the originating party 
highlighting the changes. This process repeats until the two parties agree on the terms. ^ 143, 
lines 3-7) 

As per claim 8, Yin teaches the method wherein said interactive means includes means 
for a covered entity to offer and for a business associate to accept said non-negotiable terms in 
the MBAC. (In the simplest scenario the addressed party adds or modifies clauses to the 
document and save[s] it. The saving process presents the document to the originating party 
highlighting the changes. This process repeats until the two parties agree on the terms. 1 143, 
lines 3-7) 

As per claim 9, Yin teaches the method including the additional step of accessing a 
selected multilateral contractual agreement in said MBAC database for permission to disclose 
selected private data to a selected self-certified business associate, (via a rules analyzer engine 
that "retrieves from the data store information in the database". These rules then "help guide the 
business between the partnering providers". 1 108, lines 4-10) 



Application/Control Number: 10/620,241 Page 7 

Art Unit: 4127 

As per claim 10, Yin teaches the method wherein said electronic interface comprises the 
internet. (Paragraph 144 discloses an example of a user utilizing web pages and HTML, lines 6- 
7) 

4. Claims 5, 6, and 11-16 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Yin (2002/0091539), 65 Fed. Reg. 82796 (Dec. 28, 2000), and Smithies (5,818,955) as 
applied to claim 4 above, and further in view of Examiner's Official Notice. 

As per claim 6, Examiner takes Official Notice that warranty clauses are extremely old 
and well known in the art of contract negations. It would have been extremely obvious to one 
skilled in the art of contract negotiations to have a warranty clause in the MBAC. Motivation is 
evident as the creation of a warranty clause allows for more complete negotiation and prevents 
future litigation. 

As per claim 5, Yin fails to teach the method wherein said self-certification procedures 
comprise the additional steps of: 

providing a self-certification standard affidavit template for self-certification by 
electronic signature; and 

storing affidavits corresponding to said template in a separate self-certification database. 

However, Smithies teaches a self-certified affidavit template, such as the one shown in 
Figure 3 A, for self-certification by electronic signature and storing of these affidavits in a 
database. Examiner takes Official Notice that it is old and well known in the art of database 
management to use multiple files or databases for storing information. 

It would have been obvious to modify the method of Yin and Smithies, as modified 
above, to store contract data and save data in more than one database as taught by Examiner's 
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Official Notice in order to keep more sensitive signature data apart from the contract 
information. 

As per claim 11, Yin teaches the method for creating and managing multilateral 
contractual relationships among contracting parties under a privacy standard applicable to 
protected health information (PHI), said contracting parties comprising (1) "covered entities" 
receiving data of customers and creating, recording, using, and disclosing PHI data of such 
customers in the ordinary course of business, and (2) "business associates" requiring the use of 
said PHI data, said method comprising the steps of: 

(a) assigning digital identities to the contracting parties (vial's 126-127); 

(b) providing a multilateral Master Business Associate Contract (MBAC) template (via 
the contract template based on XML, f 136 lines 3-4); * 

(e) providing an electronic interface accessible to said digital identities, said electronic 
interface being selectively connectable to the self-certification database to facilitate negotiating 
and entering binding multilateral contractual agreements among at least one of said self-certified 
covered entities and a plurality of said self-certified business associates pursuant to the terms of 
said affidavits and said MBAC template (the addressed party adds or modifies clauses to the 
document and save[s] it. The saving process presents the document to the originating party 
highlighting the changes. The process repeats until the two parties agree on the terms, ^ 143 
lines 407); and 

(f) storing said multilateral contractual agreements in an MBAC database, (the final 
signed document will be saved, f 143 line 8) 
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However, Yin fails to explicitly disclose that the template has non-negotiable terms 
requiring observation of said privacy standard with respect to said PHI data of customer. 

The Federal Registrar teaches that Federal rules require non-negotiable terms that require 
observation of privacy standards with respect to customer data. For example, Section 164.530 
requires an entity to maintain specific policies and procedures in written or electronic form to 
protect health information. 

It would have been obvious to one skilled in the art of contractual agreements to modify 
the method for creating contracts of Yin with the non-negotiable terms as taught by the Federal 
Registrar in order to protect the privacy of the medical data of customers. Motivation is evident 
based on the fact that these agreements are common and any automation would save a great deal 
of time. 

Yin further fails to disclose (c) providing a self certification standard affidavit- template 
for contracting parties to certify adherence to said privacy standard as self-certified covered 
entities or as self-certified business associates by electronic signature so as to achieve self- 
certification; and (d) storing affidavits corresponding to said template in a separate self- 
certification database. 

However, Smithies teaches a self-certified affidavit template, such as the one shown in 
Figure 3 A, for self-certification by electronic signature and storing of these affidavits in a 
database. While the sample form does not explicitly state adherence to said privacy standard, it 
is clear that the self certification form can be modified to adhere to any contractual agreement. It 
would have been obvious to one skilled in the art of electronic contractual agreements to modify 
the self-certification form and use within the Yin and Fed. Reg. system. Examiner takes Official 
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Notice that it is old and well known in the art of database management to use multiple files or 
databases for storing information. 

It would have been obvious to modify the method of Yin and Smithies, as modified 
above, to store contract data and save data in more than one database as taught by Examiner's 
Official Notice in order to keep more sensitive signature data apart from the contract 
information. 

As per claim 12, Yin teaches the method wherein said electronic interface includes 
interactive means for negotiating said additional terms with respect to use or disclosure of said 
PHI data. (In the simplest scenario the addressed party adds or modifies clauses to the document 
and save[s] it. The saving process presents the document to the originating party highlighting the 
changes. This process repeats until the two parties agree on the terms, f 143, lines 3-7) 

As per claim 13, Yin teaches the method wherein said interactive means includes means 
for a covered entity to offer and for a business associate to accept said non-negotiable terms in 
the MBAC. (In the simplest scenario the addressed party adds or modifies clauses to the 
document and save[s] it. The saving process presents the document to the originating party 
highlighting the changes. This process repeats until the two parties agree on the terms. K 143, 
lines 3-7) 

As per claim 14, Yin teaches the method including the additional step of accessing a 
selected multilateral contractual agreement in said MBAC database for permission to disclose 
selected PHI data to a selected self-certified business associate, (via a rules analyzer engine that 
"retrieves from the data store information in the database". These rules then "help guide the 
business between the partnering providers' 5 . ^[ 108, lines 4-10) 
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As per claim 15, Yin teaches the method wherein said electronic interface comprises the 
internet. (Paragraph 144 discloses an example of a user utilizing web pages and HTML, lines 6- 
7) 

Conclusion 

5. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. Wheeler (2003/0177361) teaches a method and system for using electronic 
communication for a contract. Donahue (7,146,343) teaches a method and apparatus for 
negotiating a contract over a computer network. Lastly, Dray (2002/184485) teaches a method 
for self-verification of electronic documents. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Michael P. Lux whose telephone number is 571-270-5104. The 
examiner can normally be reached on Monday to Thursday from 7:30 AM to 5:00 PM EST. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Lynda Jasmin can be reached on 571-270-3033. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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